Method and apparatus for provisioning a network switch port

CROSS REFERENCE TO RELATED APPLICATION

0001The present application claims priority to and is a continuation of co-owned, U.S. patent application Ser. No. 13/021,722, now U.S. Pat. No. 8,462,66, filed Feb. 5, 2011, the disclosure of which is incorporated herein by reference.

BACKGROUND

00021. Field of the Invention

0003The present disclosure relates generally to packet network devices such as switches, and more particularly to methods for configuring ports on a switch to receive packets transmitted over a virtual LAN by a network host connected to the switch.

00042. Description of Related Art

0005In traditional data center environments, where two or more network host devices, such as servers, can be aggregated by a Top of the Rack (TOR) switch, virtual LAN, (VLAN) membership information associated with traffic originating or destined to different applications from a network host, or from a virtual machine in a network host, is typically provisioned manually on the TOR switch by the network administrator. If the switch is not explicitly provisioned to receive traffic associated with a particular VLAN identity, then the switch would not forward the traffic to its destination and the traffic is simply dropped at the switch. Each physical interface or port on a TOR switch that is directly connected to a network host is manually configured to receive traffic associated with a particular VLAN based on the applications that are included on a network host device.

0006Data centers can include many TOR switches each one of which can be connected to forty or more network host devices, and each of the network host devices may be able to support one hundred twenty eight or more virtual machines, each one of which can be responsible for running a different application or service. In the case that two or more virtual machines are responsible for running an application or service, the traffic to and from this grouping of virtual machines can be assigned to a particular VLAN (VLAN identity). As can be imagined, such a LAN topology can be configured to support a large number of VLANs, each one of which needs to be configured on a packet network device connected to the host devices associated with the various VLAN identities. Typically, a system administrator is responsible for setting up an application or service on one or more network host devices, and a network administrator is typically responsible for ensuring that the switches that operate to process the host traffic are configured to support this traffic. Using this management model, the system administrator needs to accurately convey to the network administrator the identities of VLANs and their associations with host devices or with the virtual machines running on the host devices. Then the system administrator uses the system configuration information to provision the network switches to support the traffic to and from the host devices. This sort of manual process can easily lead to errors in configuring both the host devices and the network switches.

0007In light of the problems associated with manually configuring and provisioning network host and switch devices, there is significant motivation to provide for an automatic process to perform this procedure.

SUMMARY

0008It was discovered that a network switch can be configured with functionality that permits it to discover configuration information associated with one or more network host devices to which it is connected, and use this host device configuration information to automatically provision its ports to process traffic assigned to particular virtual LANs going to or coming from the host devices. In one embodiment, a method for provisioning at least one port on a packet network device with a VLAN ID is comprised of the packet network device establishing a communication session with a hypervisor associated with a network host device and discovering host configuration information maintained by the hypervisor which it uses to identify and store a pair of data object attributes; the packet network device is configured to trap at least one packet that ingresses to the device and to identify network source information included in the packet, it is configured to compare the network source information to the pair of data object attributes, and if there is a match between each of the attributes in the attribute pair and the source information included in the trapped packet, the packet network device provisions the port with the VLAN ID.

BRIEF DESCRIPTION OF THE DRAWINGS

0009The present invention can be best understood by reading the specification with reference to the following figures, in which:

0010<figref idref="DRAWINGS">FIG. 1</figref>: High level diagram of network <b>10</b>.

0011<figref idref="DRAWINGS">FIG. 2</figref>: Detailed diagram of network <b>10</b>.

0012<figref idref="DRAWINGS">FIG. 3</figref>: Block diagram of network host device functional elements.

0013<figref idref="DRAWINGS">FIG. 4</figref>: Block diagram of network switch functional elements.

0014<figref idref="DRAWINGS">FIG. 5</figref>: Block diagram of control processor functional elements.

0015<figref idref="DRAWINGS">FIG. 6</figref>: Block diagram of line card functional elements.

0016<figref idref="DRAWINGS">FIGS. 7A &amp; 7B</figref>: Logical flow diagram of port provisioning process.

DETAILED DESCRIPTION

0017With the advent of network host device virtualization and virtual host sprawl, it is becoming important for vendors to provide tools and processes for automating data center operations such as configuring ports on network switches connected to the network hosts to handle traffic from the virtual machines running on host devices. It is essential that these automatic configuration tools react to the dynamics of virtual machine deployment and migration in a timely fashion.

0018<figref idref="DRAWINGS">FIG. 1</figref> is a diagram showing a local area network (LAN) <b>10</b> comprised of a single top of the rack (TOR) switch connected to some number of physical network host devices, such as servers. The connectivity between the switch and the hosts can be implemented in a standard LAN wired protocol such as the Ethernet protocol, or can be implemented in any standard or proprietary protocol that supports communication between network switches and network host devices. Each of the network host devices in this case include two or more virtual machines one or more of which can be responsible for running an application or providing a service to a client device in the network (not shown).

0019<figref idref="DRAWINGS">FIG. 2</figref> is a more detailed diagram of the LAN <b>10</b> of <figref idref="DRAWINGS">FIG. 1</figref> showing a network switch <b>20</b> connected over Ethernet links to a number of network host devices, H₀-H_n. Each of the host devices include one or more physical interfaces (PNICs) to the Ethernet links. Host H.<b>0</b> is shown to include a single interface which is connected to a virtual switch (vSW), and the virtual switch is in turn connected to two or more virtual machines (VMs). Although, for the purpose of this description, the Host H.<b>0</b> is shown with only on physical interface and one vSW, a host device typically can include more than one PNIC and vSWs. The virtual functionality comprising each of the host devices operate under the general control of a hypervisor (HyperV.) such as vSphere (which is a hypervisor designed and sold by VMWare®, Inc.) or the Citrix Xen Hypervisor (which is an hypervisor sold by Citrix® Systems, Inc.). Among other things, the hypervisor generally operates to create VMs and to assign them to host devices, to create virtual switches and assign the virtual switches to VMs and to maintain a set of data objects in which the identity the VMs, virtual switches, VLANs and PNICs are stored as well as the interconnections (configuration) between them. As will be described later, attributes comprising the data objects can be discovered by a network device, such as a network switch, that is connected to the host device and hypervisor for the purpose of configuring the switch to receive traffic from the host.

0020Continuing to refer to <figref idref="DRAWINGS">FIG. 2</figref>, the virtual switch in host H.<b>0</b> is shown to be connected to a number of VMs, VM₀-VM_n, and in this case each of the VMs in this group is assigned to a VLAN <b>21</b>. Each of the other host devices, H.<b>1</b> and H.<b>2</b> can include essentially the same functional elements as host device H.<b>0</b>, and be configured in the same or different manner to have more or fewer VMs, virtual switches, physical interfaces, etc. depending upon the application run on the host and/or the service(s) provided by the host.

0021<figref idref="DRAWINGS">FIG. 3</figref> is a more detailed diagram of a network host <b>30</b> which is similar to the network host device H.<b>0</b> described with reference to <figref idref="DRAWINGS">FIG. 2</figref>. Host <b>30</b> is shown to include a plurality of PNICs, PNIC₀-PNIC_neach of which are connected to a corresponding virtual switch, VS₀-VS_n, and each of the virtual switches are, in turn, connected to some number of VMs, VIM₀-VM_nover a virtual bus <b>35</b>. A hypervisor <b>34</b> operates, under the control of a management console <b>33</b>, as a virtual management layer between the servers physical components and the virtual components. A detailed discussion of the operation of a hypervisor is not undertaken here, as their operation in a host environment is well understood by network engineers. The hypervisor <b>32</b> maintains a set of data objects <b>36</b> each of which is comprised of one or more attributes which include configuration information relating to the physical and virtual components running on each of the host devices. For instance, a data object “HostNetworkinfo” can include a set of attributes such as pnic, portgroup and vnic. The pnic attribute name is of type PhysicalNic[ ] which is the identity of a particular PNIC on a host device, and can be PysicalNic[1] for instance. Another data object “HostPortGroupSpec” can include a set of attributes such as policy, vlanid and vswitchName, and so forth. As with the pnic attribute type, the vlanid attribute type includes information identifying a particular VLAN that is configured on a host device such as the host <b>30</b>. In <figref idref="DRAWINGS">FIG. 3</figref>, two VLANs are identified as VLAN-<b>31</b> and VLAN-<b>32</b>. In this case, VLAN<b>31</b> is configured on the host <b>30</b> to encompass traffic to and from virtual machines VM.<b>0</b> and VM.<b>1</b>, and VLAN-<b>32</b> is configured on the host <b>30</b> to encompass traffic to and from virtual machines VM.<b>2</b> and VM.<b>3</b>.

0022<figref idref="DRAWINGS">FIG. 4</figref> is a diagram showing in more detail the functional elements that can be included in the switch <b>20</b> of <figref idref="DRAWINGS">FIG. 3</figref>. Switch <b>20</b> is shown to include a control module (CM) <b>40</b>, which is generally responsible for running management plane functionality, and switch <b>20</b> is shown to include a line card (LC) <b>44</b> which is generally responsible for data plane functionality. Switch <b>20</b> can also include switch fabric modules and other functional modules, but for the purpose of this description it is not important to describe their operation. The control module <b>40</b> can include one or more route processor modules (RPM) which generally operate to run network protocols necessary for the operation of the switch <b>20</b> in the network environment in which the switch is located. In this case, a single RPM <b>41</b> is shown which generally operates to run layer-2 network protocols, and the RPM <b>41</b> in one embodiment includes a port provisioning manager <b>42</b> and a port configuration manger <b>43</b>. The port provisioning manager <b>42</b> generally operates to discover data object attributes maintained by a hypervisor associated with a network host device, such as the host device <b>30</b> of <figref idref="DRAWINGS">FIG. 3</figref>, and to use this attribute information with information received from incoming packets transmitted by the host device <b>30</b> and copied to the provisioning manager by a trap <b>46</b> located on the LC <b>44</b> to determine how to provision ports on the switch <b>20</b>. This port provisioning information is then passed to the configuration manager <b>43</b> which is responsible to entering information into a forwarding table <b>45</b> that is typically located on a line card, such as LC <b>44</b>. A more detailed description of the operation of the RPM <b>41</b> is included below with reference to <figref idref="DRAWINGS">FIG. 5</figref>.

0023<figref idref="DRAWINGS">FIG. 5</figref> is a more detailed diagram of the RPM <b>41</b> described with reference to <figref idref="DRAWINGS">FIG. 4</figref> showing the port provisioning manager <b>42</b> and the port configuration manager <b>43</b>. The port provisioning manager <b>42</b> includes an agent <b>50</b> for establishing a communication session over one or more selected ports on the network switch <b>30</b> with a hypervisor associated with a network host such as the hypervisor <b>32</b> associated with the host <b>30</b> described earlier with reference to <figref idref="DRAWINGS">FIG. 3</figref>. The agent <b>50</b> can employ the well known Telnet protocol, or any other suitable communication protocol for instance, to establish a session with the hypervisor. The agent <b>50</b> includes a hypervisor data object subscription function <b>55</b> that operates, upon start up of the switch <b>30</b>, to register interest with the hypervisor in particular data object attributes. Subsequent to registering this interest with the hypervisor, the hypervisor can automatically send to the switch <b>30</b> any changes in the attributes subscribed to by the subscription function. Alternatively, the agent <b>50</b> can periodically request that the hypervisor sends changes in attributes of interest, but it is desirable for the switch to receive attribute changes as quickly as possible so that traffic is not dropped as the result of the switch not reconfiguring its ports in a timely manner. In one embodiment, the switch <b>30</b> can register interest with the hypervisor <b>32</b> to receive changes in configuration with respect to, among other things, the virtual machines on the network host <b>30</b> (i.e., creation of new VMs or reconfiguration of existing VM to be associated with another vSW or PNIC) any changes with respect to the configuration of the virtual switches and any changes with respect to a VLAN configuration.

0024Continuing to refer to <figref idref="DRAWINGS">FIG. 5</figref>, an attribute list <b>51</b>, located in memory associated with the provisioning manager <b>42</b>, stores all of the data object attribute information sent to the RPM <b>41</b> by the hypervisor <b>32</b> for use by compare logic <b>53</b> as will be described shortly. The provisioning manager also includes a VLAN assignment table manager <b>52</b> that operates to generate instructions that are stored in a VLAN assignment table (VAT) located in the LC <b>44</b>, described earlier with reference to <figref idref="DRAWINGS">FIG. 4</figref>. In operation, the VAT table manager <b>52</b> operates on information that it receives from the compare logic <b>53</b> to generate instructions/policies that are stored in the VAT table, the operation of which is described later with reference to <figref idref="DRAWINGS">FIG. 6</figref>. In operation, the provisioning manager <b>42</b>, subsequent to subscribing to discover certain attributes associated with the data objects managed by a host device hypervisor, periodically receives attribute change information from the hypervisor <b>32</b> and stores this attribute information in the attribute list <b>51</b>. This attribute information can be in the form of a VLAN identity, the MAC address of a virtual machine or the MAC address of a PNIC, to name only three attributes. For the purpose of this discussion, it is assumed that the data object attribute information is stored in the attribute list <b>51</b> in the form of an attribute pair, with one such pair being comprised of a VMAC (address of VM) and a VLAN identity assigned to the VM. The attribute list can store one or more of these attribute pairs, and this attribute information is used by the comparison logic <b>53</b> to provision a port as described below.

0025With further reference to <figref idref="DRAWINGS">FIG. 5</figref>, the comparison logic <b>53</b> receives a copy of a packet sent to it by a trap <b>46</b> on the LC <b>44</b>, which will be described later with reference to <figref idref="DRAWINGS">FIG. 6</figref>. The comparison logic <b>53</b> examines the packet header for information corresponding to attribute information stored in the attribute list <b>51</b>, and if the comparison logic <b>53</b> determines that the packet header includes both a VMAC and VLAN ID that match information included in an attribute pair stored in the attribute table <b>51</b>, then the comparison logic sends a message to a port configuration manager <b>42</b> indicating that a particular port on the switch <b>20</b> should be configured to receive traffic labeled with the VLAN ID included in the packet header.

0026<figref idref="DRAWINGS">FIG. 6</figref> illustrates, in more detail, functionality included on the LC <b>44</b> described with reference to <figref idref="DRAWINGS">FIG. 4</figref> that can be employed to implement one embodiment of the port provisioning process. Although <figref idref="DRAWINGS">FIG. 6</figref> shows only one line card, more than one line card can be included in the switch <b>20</b>. As shown in <figref idref="DRAWINGS">FIG. 6</figref>, the LC <b>44</b> can include one or more input/output ports over which network or host information can be received or transmitted respectively, a port configuration management agent <b>61</b> that operates to carry out instructions sent to it by the configuration manager <b>43</b> of <figref idref="DRAWINGS">FIG. 5</figref>, a trap <b>46</b> for copying information received in packets from the host device <b>30</b> of <figref idref="DRAWINGS">FIG. 3</figref>, a packet processor <b>62</b> that generally operates to examine the contents of packets ingressing on the switch <b>20</b> in order to determine how to forward the packets to their correct destination, and the LC <b>44</b> includes one or more forwarding/switching tables <b>63</b> which can store information used by the packet processor <b>62</b>. The trap <b>46</b> can be implemented in software which can be stored in memory associated with the line card, or the trap <b>46</b> can be implemented in firmware stored in memory associated with a processing device such as a packet processing device.

0027Referring now to the functional elements shown in <figref idref="DRAWINGS">FIG. 6</figref> in more detail, the trap <b>46</b> includes a packet copy and transmit function <b>64</b> and a packet copy policy table (referred to here as VAT table <b>65</b>) for each port on the LC <b>44</b>. The copy and transmit function <b>64</b> operates to examine the contents of incoming packets to identify source information, such as a virtual MAC address associated with a virtual machine (VM), a virtual LAN (VLAN) identity and/or the MAC address of a PNIC, and depending upon instructions included in the VAT table <b>65</b> entries, copies or does not copy the contents of the incoming packet, and if the contents are copied, sends this information to the RPM over an IPC link as shown in <figref idref="DRAWINGS">FIG. 6</figref>. When the switch <b>20</b> is first initialized, the VAT table <b>65</b> is configured with a default entry/instruction which causes the packet copy and transmit function <b>64</b> to copy all of the incoming packets and send the copies to the compare logic <b>53</b> described earlier with reference to <figref idref="DRAWINGS">FIG. 5</figref>. Specifically, immediately after initializing the switch <b>20</b>, an first incoming packet is received by a port on the LC <b>44</b> and is sent to the packet copy and transmit function <b>64</b> in trap <b>46</b>. The packet copy function <b>64</b> examines the packet header information and the default instruction in the VAT table <b>65</b> and, depending upon the contents of the VAT table instruction, copies at least a portion of the information comprising the packet header and sends this information to the compare logic <b>53</b>. The default instruction in this case is an instruction to copy all packets that are received by the switch regardless of their source. Depending upon the result of the comparison operation performed by the comparison logic <b>53</b>, a second, higher priority instruction (higher priority than the default instruction) can be entered into the table by the VAT table manager <b>52</b> that can be an instruction to, for instance, not copy all subsequent packets with the same source information (attribute pair information) as the first packet. Eventually, after the VAT table reaches a steady state or after the provisioning manager <b>42</b> completes discovery for a particular port, the VAT table entries are flushed and the provisioning manager waits to detect a change to the attribute list <b>51</b>, at which point the VAT table manager <b>52</b> populates the VAT table with the appropriate instructions.

0028At the point in time that the provisioning manager <b>42</b> determines that a particular port should be configured to receive traffic associated with a particular VLAN ID, the compare logic <b>53</b> can send a message to the port configuration manager <b>43</b> which in turn instructs a port configuration agent <b>61</b> located on the LC <b>44</b> to place an entry in the forwarding/switching table <b>63</b> that associates a VLAN ID with a particular egress port on the switch <b>20</b>. An embodiment of a process for automatically provisioning a port to receive traffic from a network host over a particular VLAN is now described with reference to <figref idref="DRAWINGS">FIG. 7A</figref>. In step one, a network switch, such as the network switch <b>20</b> described previously with respect to <figref idref="DRAWINGS">FIGS. 4 and 5</figref>, is initialized or rebooted and in step <b>2</b>, the port provisioning manager <b>42</b> establishes a communication session with a hypervisor, such as the hypervisor <b>32</b> associated with the network host device <b>30</b> with reference to <figref idref="DRAWINGS">FIG. 3</figref>, and registers its interest in receiving particular attributes stored in data objects by the hypervisor. These data object attributes can include, among other things, information about the identities of one or more VLANs, virtual MAC addresses assigned to virtual machines configured on the host <b>30</b> or MAC addresses assigned to the PNICs on the host <b>30</b>. In step <b>3</b>, the hypervisor can automatically send attribute information of interest to the switch <b>20</b> which the switch can store in an attribute list <b>51</b> for later use. In step <b>4</b>, the VAT table manager <b>52</b> in <figref idref="DRAWINGS">FIG. 5</figref> can install an entry into the VAT table <b>65</b> of <figref idref="DRAWINGS">FIG. 6</figref> that is a default policy with an instruction, for the packet copy and transmit function <b>64</b> of <figref idref="DRAWINGS">FIG. 6</figref>, to copy all packets arriving at a particular port on the switch <b>20</b> and to send the copy of the packet to the comparison logic <b>53</b> in the port provisioning manager of switch <b>20</b>.

0029Continuing to refer to <figref idref="DRAWINGS">FIG. 7A</figref>, in step <b>5</b> the switch <b>20</b> receives a first packet from the host <b>30</b>, and in step <b>6</b> the function <b>64</b> examines the highest priority policy stored in the VAT table, which in this case is the default policy (because at this point it can be the only policy), and if the policy includes an instruction to copy the packet, in step <b>8</b> the first packet is copied and sent to the comparison logic <b>53</b>. If, on the other hand, the highest priority policy includes an instruction to not copy the packet, then in step <b>7</b> the packet is sent to the packet processor <b>62</b> of <figref idref="DRAWINGS">FIG. 6</figref> and is processed/forwarded in the normal manner.

0030Referring now to <figref idref="DRAWINGS">FIG. 7B</figref>, in step <b>9</b> the comparison logic <b>53</b> examines source information included in the packet header and compares this information to information stored in the attribute list <b>51</b>. So for example, if the comparison logic is programmed to compare VMAC and VLAN information identified in the packet header with information in the attribute table, and this comparison yields a match (that is the VMAC and VLAN information in the packet header and a VMAC/VLAN pair in the attribute table match), then in step <b>11</b> the compare logic sends an instruction to the port configuration manager to configure the forwarding table <b>63</b> on the LC <b>44</b> so that a packet sent to the switch <b>20</b> from the host <b>30</b> over the VLAN is forwarded. Otherwise, in step <b>10</b> the packet is dropped. Proceeding to step <b>12</b>, the port configuration manager sends an instruction to the port configuration agent <b>61</b> in <figref idref="DRAWINGS">FIG. 6</figref> to insert an entry into the forwarding table <b>63</b> that can include, for instance, the VMAC address and VLAN identity included in the first packet received by the switch <b>20</b> in step <b>5</b> of the process, and at the same time, the VAT table manager <b>52</b> installs an entry into the VAT table <b>65</b> in trap <b>46</b> to not copy any subsequent packets that include the same VMAC/VLAN pair.

0031Continuing to refer to <figref idref="DRAWINGS">FIG. 7B</figref>, in step <b>13</b> if the discovery process for a particular port associated with the trap <b>46</b> has not complete, then in step <b>14</b> the process returns to step <b>5</b> in <figref idref="DRAWINGS">FIG. 7A</figref>, otherwise the process proceeds to step <b>15</b> where the VAT table entries are flushed and the provisioning manager <b>42</b> waits to receive an attribute (this is a change to an attribute of interest) from the hypervisor. In step <b>16</b>, when the port provisioning manager <b>42</b> receives an attribute from the hypervisor, in step <b>17</b> the process returns to step <b>4</b> in <figref idref="DRAWINGS">FIG. 7A</figref> and the provisioning manager (VAT table manager) installs a default policy into the VAT table and the process proceeds as before.

0032The forgoing description, for purposes of explanation, used specific nomenclature to provide a thorough understanding of the invention. However, it will be apparent to one skilled in the art that specific details are not required in order to practice the invention. Thus, the forgoing descriptions of specific embodiments of the invention are presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed; obviously, many modifications and variations are possible in view of the above teachings. The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications, they thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the following claims and their equivalents define the scope of the invention.